attack.t1562.006 | Detection.FYI

Disable of ETW Trace
Feb 21, 2023 · attack.defense_evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·
Share on:
Detects a command that clears or disables any ETW trace log which could indicate a logging evasion.

Read More
Disable of ETW Trace - Powershell
Feb 1, 2023 · attack.defense_evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·
Share on:
Detects usage of powershell cmdlets to disable or remove ETW trace sessions

Read More
Auditing Configuration Changes on Linux Host
Oct 25, 2022 · attack.defense_evasion attack.t1562.006 ·
Share on:
Detect changes in auditd configuration files

Read More
Logging Configuration Changes on Linux Host
Oct 25, 2022 · attack.defense_evasion attack.t1562.006 ·
Share on:
Detect changes of syslog daemons configuration files

Read More